Complete the Shopping Cart Admin Tool for Your PHP Online Store [con't]
The Final Two Scripts for the Shopping Cart
In the previous section, we looked at the main/change.php script. In this section, we will examine the two remaining scripts for shopping cart administration, which respectively enable the administrator to insert a new book and remove an existing book. Here's a screenshot of the form for adding a new book:
Let's jump right into the code.
The first part of the code initializes the following variables:
$err- Boolean variable that is set to true when an error occurs$$errmsg- Variable that stores the error message$$isfile- Boolean variable that is set to true if a file is present
All of them are used at different times throughout the script. Usually, you don't need to initialize variables, but in some environments you get a warning stating that the variable was not defined. So, I'm just trying to cover all the bases by initializing them.
Now, the overall purpose of this script is to enable the administrator to insert a new book. So, after the form has been submitted, we put the form variables through the usual filter process:
Next, we check if there is a file to be uploaded and set the $isfile variable to true or false depending:
The next two pieces of code insert information into the publisher and author tables and store the last inserted record number using the mysql_insert_id() function to capture the ID:
Note the use of the $err and $errmsg variables. Though this is a good way to handle error messages, it is advisable to use an error-logging class or the PHP logs themselves to write errors to, when not in development. PHP error messages are notorious for leaking sensitive information. Sometimes you can't prevent that, because it might be the way your web host set up PHP on their servers. Most people these days make sure that they configure their PHP settings correctly to avoid this kind of security vulnerability.
When all the newly inserted record IDs are safely stored in variables, the code then goes on to insert the new book details into the books table, including the IDs mentioned above:
The script needs the newly inserted record ID, because it will use it in the upload code to match the newly uploaded file to the right record in the books table:
Next is the code that actually uploads the file. An upload path is defined and the directory in this case is uploads. Make sure that the folder has all the necessary permissions before trying to upload a file.
The next part transfers the uploaded file name into a variable called $filename, then the variable is "cleaned" with the mysql_real_escape_string() function:
Next, the file is moved to its final destination and the books table is updated accordingly. If the update is successful, then a "File uploaded and saved" message is sent later:
The actual HTML basically displays a form that has fields that match each table in the database, look at the red text:
Next comes the delete.php script:
The delete script is responsible for removing books from the database. It receives a bookid variable, which we put through the filtering process to validate and clean.
After that, the query to remove the book is run:
Then we redirect the user to the booklist page or an error page depending on whether the query was successful:
Original: March 26, 2010
Find a programming school near you
